On 11 and 12 September 2026, Revolut customers and then the press saw a notice saying the company had disclosed customer information to an unauthorized party. The request appeared to come from a legitimate government agency, and the email domain was real. This was not an intrusion into Revolut systems, according to the company.
What is confirmed
TechCrunch published a Revolut spokesperson statement on 12 September.
- Revolut said it "recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email."
- The company said its systems and customer funds are unaffected.
- A "limited" number of customers were affected, and Revolut said it contacted them directly.
- Revolut said it blocked the sending address and alerted the agency, law enforcement and regulators.
What is reported
- TechCrunch, reviewing the customer email, reports the data may include birth date, postal and email addresses, phone numbers and copies of identity documents such as passports and driver's licenses. The notice also says it may have included verification selfies, account statements and transaction histories.
- Security Affairs quotes the notice as saying the message "carried valid domain authentication credentials" and was fulfilled "under the reasonable belief" that it was genuine. It also quotes the notice as saying no biometric facial telemetry data was involved.
- A researcher posted the notice publicly late on 11 September, which is how the incident became known. The researcher said targets appeared to be high net worth users. That is the researcher's view, not a Revolut statement.
What is not known
- How many customers were affected. Revolut gave no number.
- Which government agency's domain was abused, and in which country or market.
- Whether the fraudster controlled the agency mailbox or spoofed it in a way that still passed authentication checks.
- Who is responsible.
What to do now
- Write a rule that no customer data leaves your company on the strength of an email alone, even from a trusted domain. Verify through a contact path you already hold.
- Route legal and government data requests through one named team with a call back step.
- Limit what a single request can return. Identity documents and full transaction histories need a second approver.
- If you were a Revolut customer who got the notice, watch for targeted phishing, and be cautious with unexpected contact that quotes your account details.
How this could have been avoided
- A call back to the agency using a number from an independent source. Security Affairs reports Revolut only found the fraud after contacting the agency to verify.
- Treating passed domain authentication as proof of sender identity only, not of a legitimate request. The notice itself says the message passed those checks.
- A two person rule for releasing identity documents, selfies and full transaction history.
- Logging and reviewing every disclosure made in response to an outside request.
Try it yourself
Map how outside requests for data reach your team, and who approves each release.
Click through it at your own pace, or open it full screen.
Quick check
Was Revolut hacked?
Revolut says its systems were not breached. It says it was deceived by a fraudulent request that appeared to come from a government agency.
Does a passing email domain check prove a request is real?
No. It shows the message came from that domain. It does not show the person asking is authorized, so verify by a separate channel.
